Scope Neo4j queries by can:// id prefix and retire _module (codeanalyzer-python 1.4.1) #327

Problem

codeanalyzer-python 1.4.1 removes the _module property from every graph node. In its emitter, rows.py:133 does props.pop("_module", None) # lifted off the graph, and its own destructive statements now scope on the can:// id prefix instead (x.id = <id> OR x.id STARTS WITH <id> + '/'), with a :PyCanNode label and a range index on id so the prefix predicate seeks rather than scans.

PyNeo4jBackend depends on _module structurally — 126 references in cldk/analysis/python/neo4j/neo4j_backend.py:

• the application-scope predicate on every bulk and per-parent statement (… _module IN $mods), added in leg 1.5 to keep a shared multi-application graph from leaking;
• the quantified-path call walks (get_call_graph(roots=), reaches, backward_cone), scoped at every hop on _module;
• PyCallableOverview.path and its siblings, projected from c._module;
• the multi-application audit test, whose rule is "signature-matched statements must carry IN $mods".

_probe_schema checks CALL db.relationshipTypes() only. Against a graph emitted by 1.4.1 it passes, attach succeeds, and every scoped query returns empty — the ambiguous-empty failure the 2.0 design exists to remove (leg-1 spec D7).

Decision

Adapt the SDK to id-prefix scoping before cutting 2.0.0rc2, and pin 1.4.1. Recorded 2026-09-06; the alternative (ship rc.2 on 1.4.0 with the probe refusing 1.4.1) was considered and rejected because 1.4.1 also carries the fixes for #176 (BodyNode id), #177 (entrypoint report projected) and #178 (PY_EXTENDS emitted), which the 2.0 surface wants.

Scope

• Replace every _module-based scope predicate with an id-prefix predicate anchored on the application: n.id STARTS WITH 'can://python/<app>/'. The :PyCanNode range index makes this a seek.
• Replace c._module AS path projections with the module key derived from the id (the id embeds language, application and file).
• Rewrite the multi-application audit test's rule: signature-matched statements must carry the prefix predicate; id-keyed statements are safe by construction (unchanged).
• _probe_schema reads :PyApplication.analyzer_version (already projected) and refuses graphs it cannot serve, naming the version and the reason — both directions: a 1.4.0 graph against a backend written for 1.4.1, and vice versa, if the two are not both supported.
• Local backend parity: nothing there uses _module, but every accessor's cross-backend test must be re-run against a 1.4.1 graph.
• Bump codeanalyzer-python==1.4.1 in dependencies and [tool.backend-versions].

Verification environment

A fresh container (cldk-leg16-it, bolt 7689) holding odoo-slim-19 emitted by 1.4.1. The existing cldk-leg1-it (7688, emitted by 1.4.0) stays up as the before-image so the two can be diffed.

Caveats

• 1.4.1 also renumbers nothing but adds ids to body nodes and parameters (#180) and projects the entrypoint report (Announce releases in repo and org Discussions #182). Tests that pinned "zero entrypoints" or "BodyNode has no id" as the analyzer's behaviour will flip; they must be re-read, not just re-run.
• test_python_neo4j_backend.py (the emitting parity module, test_python_neo4j_backend.py writes to whatever CLDK_TEST_NEO4J_URI points at, and never cleans up #324) is the one place that can legitimately emit into a scratch server; it keys off CLDK_TEST_NEO4J_WRITE_URI and must never be pointed at either integration container.
• The prefix must include the trailing / so odoo-slim-19 cannot match odoo-slim-19-b; 1.4.1's own wipe already encodes that rule.

Definition of done

• grep -c _module cldk/analysis/python/neo4j/neo4j_backend.py is 0, or every remaining occurrence is a comment explaining history.
• The full live suite passes against the 1.4.1-emitted odoo-slim-19 (baseline 516 on 1.4.0), and the bounded-call-graph hub numbers (638/27,568 at depth 1; 1,818/63,871 at depth 2) are unchanged or their change is explained by a 1.4.1 emitter change.
• Attaching the backend to the 1.4.0 graph on 7688 produces a clear refusal (or works, if dual support is chosen — stated either way).
• The multi-application audit enumerates every MATCH statement on the backend under the new rule.
• CHANGELOG and docs/agent-api-reference.md record the pin bump and the scoping change.

Blocks the 2.0.0rc2 cut. Part of codellm-devkit/.github#55. Follows #323.